Android-Debug-Database
Android-Debug-Database copied to clipboard
This library is being used by apps in production
I found out about this library in a sad way. I found tons of devices with it exposed on :8080 on shodan, and tracked down a couple of (big) apps using it in production. (read here: https://deletescape.ch/posts/how-to-leak-all-user-data/)
My suggestion here would be to actually prevent the library from working at all in non-debug builds (potentially adding an override flag for locally debugging prod builds), so this cannot happen by accident. I know that the docs in this repo make it very clear to use it only on debug builds and how to achieve that, and I put no blame on you, but I think it is important to try and prevent this from happening again in every way possible.
Hey, @deletescape
Yes, It is clearly mentioned in the document.
Use debugImplementation
so that it will only compile in your debug build and not in your release build.
Yes, of course, we can add the extra flag to prevent this.